mewin/libpng
1
0
Fork 0
mirror of https://git.code.sf.net/p/libpng/code.git synced 2025-07-10 18:04:09 +02:00
Code Issues Projects Releases Wiki Activity

[libpng15] Corrected filter heuristic overflow handling.

Browse Source
This commit is contained in:
John Bowler
2016-06-19 18:01:33 -05:00
committed by Glenn Randers-Pehrson
parent 4a8105e925
commit 9c04f57cab
3 changed files with 54 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
CHANGES
View File

@@ -5600,7 +5600,22 @@ Version 1.6.24beta01 [June 11, 2016]
Avoid potential overflow of the PNG_IMAGE_SIZE macro. This macro
is not used within libpng, but is used in some of the examples.
Version 1.6.24beta02 [June 11, 2016]
Version 1.6.24beta02 [June 19, 2016]
Correct filter heuristic overflow handling. This was broken when the
write filter code was moved out-of-line; if there is a single filter and
the heuristic sum overflows the calculation of the filtered line is not
completed. In versions prior to 1.6 the code was duplicated in-line
and the check not performed, so the filter operation completed; however,
in the multi-filter case where the sum is performed the 'none' filter would
be selected if all the sums overflowed, even if it wasn't in the filter
list. The fix to the first problem is simply to provide PNG_SIZE_MAX as
the current lmins sum value; this means the sum can never exceed it and
overflows silently. A reasonable compiler that does choose to inline
the code will simply eliminate the sum check.
The fix to the second problem is to use high precision arithmetic (this is
implemented in 1.7), however a simple safe fix here is to chose the lowest
numbered filter in the list from png_set_filter (this only works if the
first problem is also fixed) (John Bowler).
Send comments/corrections/commendations to png-mng-implement at lists.sf.net
(subscription required; visit